CertifyDeckGH-300 · CHEAT SHEET
GitHub Copilot
Key concepts grouped by official exam weight.
Download as PDF (free, no sign-up)1. Use GitHub Copilot responsibly
15–20%Understand responsible AI principles
- Copilot can hallucinate: produce plausible but false code or text. Its quality depends on how much training data exists for each language, it can repeat biases, match public code and miss architectural issues beyond the immediate context. Pull request summaries do not refresh on their own, and in a Space only part of the content is processed.
- GitHub follows Microsoft's six responsible AI principles: fairness, reliability and safety, privacy and security, inclusiveness, transparency and accountability. Application cards provide transparency about intended uses and limitations. For consequential decisions, such as housing or employment, affected people must be able to understand, appeal and correct the data behind a decision.
- Possible harms: offensive content, insecure code, public code matches, data exfiltration and hidden instructions, plus overreliance on output. Mitigations: content filtering, blocking public code matches and IP scanning; for the cloud agent, a default firewall, pushes only to copilot/ branches, secrets only from the copilot environment and responses only to users with write access.
Validate and operate AI tools
- The user assumes the risks of generated code: bugs, vulnerabilities and IP infringement. Code can look valid yet be wrong or insecure, and generated tests may not cover every case. Understand each suggestion, review it, rely on linting, code scanning and IP scanning, and use Copilot code review as a complement to human review.
- Operating Copilot responsibly means launching Copilot CLI only from trusted directories, reviewing every command before approving it and granting minimal permissions: --deny-tool overrides --allow-all-tools. Approving a tool for the whole session allows any use of it. Cloud agent tasks should be well scoped, and with BYOK, data is subject to the provider's policies.
2. Use GitHub Copilot features
25–30%Use GitHub Copilot in the IDE
- In VS Code you just sign in with your GitHub account: the extensions install automatically and, without a plan, the account moves to Copilot Free. In JetBrains you install the plugin and authorize it with a device code. Suggestions are toggled per language with github.copilot.enable or languageAllowList, chat.disableAIFeatures turns AI off per workspace, and GHE.com needs authProvider github-enterprise.
- In the IDE, Copilot offers inline suggestions (ghost text at the cursor and next edit suggestions that predict the next edit), chat in the Chat view with Ask, Agent and Plan modes, and inline chat for focused edits in the editor. Agent mode handles multi-step tasks and can call MCP tools. Copilot CLI can connect to VS Code with /ide to use the editor selection and review diffs.
- Content exclusion stops Copilot from using certain files: no inline suggestions in them, their content does not inform responses, and Copilot code review skips them. Repository admins, organization owners and enterprise owners configure it with fnmatch-style paths; enterprise rules apply to every Copilot user, and changes are recorded in the audit log.
Use GitHub Copilot CLI
- GitHub Copilot CLI brings an AI agent to the terminal: it answers questions, writes and debugs code and works with GitHub.com, for example creating issues or pull requests on your behalf. It has an interactive interface (with plan mode) and a programmatic one for scripts, supports instructions, MCP, custom agents, hooks and skills, and replaces the old gh-copilot extension.
- Copilot CLI is installed with npm (npm install -g @github/copilot), WinGet (winget install GitHub.Copilot), Homebrew (brew install --cask copilot-cli) or the install script for macOS and Linux. It needs an active Copilot subscription and, on Business or Enterprise, an administrator who has not disabled it. On first launch you authenticate with /login or a fine-grained PAT with the Copilot Requests permission.
- In Copilot CLI, @ adds a file as context, # adds an issue or pull request and ! runs a shell command without calling the model. The --allow-tool, --deny-tool and --allow-all-tools options control approvals, and --deny-tool takes precedence. Key commands: /delegate or & for Copilot cloud agent, /fleet for parallel subagents, /ask for side questions and copilot mcp add to add MCP servers.
- When you start copilot you confirm trust in the folder and approve tools once or for the rest of the session. Shift+Tab cycles between standard, plan and autopilot modes. Sessions are saved: copilot --continue resumes the most recent one, --resume or /resume open a picker and /new starts fresh. Compaction summarizes history and creates checkpoints you can view with /session checkpoints.
- GitHub Copilot CLI works in the terminal interactively (copilot) or programmatically (copilot -p), which suits scripts and CI. It asks for approval before modifying or executing files; --allow-tool, --deny-tool (which takes precedence) and --allow-all adjust those permissions. @path adds a file as context, /add-dir grants access to another directory and /undo rolls back the conversation and files.
Use GitHub Copilot features and capabilities
- Agent mode decides which files to change, runs commands and iterates until done; edit mode (Copilot Edits) limits changes to the working set and lets you accept or discard each edit. MCP servers add tools for external systems. Subagents work in their own context and return only the result, and checkpoints restore files and chat history.
- Copilot code review reviews pull requests on GitHub and local changes in IDEs such as VS Code, with suggestions you can apply. By default it leaves Comment reviews that do not count as approvals and reviews only once unless Review new pushes is enabled. It is customized with instructions files read from the head branch and skips files such as lockfiles, logs and SVGs.
- Copilot Spaces gathers repositories, files, issues and notes so Copilot answers with that context; files are loaded in full and repositories are searched for relevance. Copilot drafts pull request summaries, best from a blank description. Review standards are set with copilot-instructions.md and *.instructions.md files that use applyTo and excludeAgent.
- Copilot Chat offers slash commands such as /tests, /fix or /explain, chat participants such as @terminal or @github, and # variables. Its answers can be wrong or insecure, so review and test them; thumbs icons rate each response. Prompt files (.prompt.md) store reusable prompts that you launch with / and that can set the agent and tools.
Manage organization-wide settings and policies
- Copilot policies are set at the enterprise first; if it picks a specific value, organizations cannot change it, and if it delegates, each organization decides. With licenses from several organizations the least restrictive setting usually wins. Copilot code review is enabled by policy and automated with rulesets; agent mode, MCP, the CLI and the app have their own policies.
- The audit log records changes to the Copilot plan (policies, settings, seats assigned or removed) and agent activity; filter with action:copilot or, for agents, actor:Copilot and fields such as agent_session_id. It does not include client session data such as local prompts. To keep long-term history and set up alerts, stream it to a SIEM.
- The Copilot user management REST API lets organization owners read the seat breakdown and settings (GET /orgs/{org}/copilot/billing), list seats with last_activity_at, and add or remove seats by user or by team. Removed seats stay pending cancellation until the cycle ends. It requires seat management set to selected members and a configured public code policy.
3. Understand GitHub Copilot data and architecture
10–15%Describe data handling and flow
- GitHub does not train models on Copilot Business or Enterprise data; on individual plans the user can disable the use of their data for training. With BYOK, prompts go to the chosen provider and fall under its policies. Local CLI sessions are stored on the machine and unshared by default; cloud agent sessions are visible to anyone with repository access.
- Before calling the model, Copilot builds a prompt: for inline suggestions it combines the code before and after the cursor (Fill-in-the-Middle) with snippets from open files. In VS Code, each chat or agent request gathers system instructions, customizations, the message, history, implicit context, explicit references and tool outputs. Excluded files do not feed the prompt.
- The prompt passes through a proxy hosted in a GitHub-owned Azure tenant that blocks manipulation attempts, and through harmful content filters. After generation, harmful content is removed and the proxy checks quality, security and, if enabled, public code matches; anything failing the filters is truncated or discarded. These filters apply whichever model is chosen.
Understand lifecycle and limitations
- A Copilot suggestion follows a lifecycle: context is gathered, the prompt goes through the proxy and filters, the model generates, post-processing checks the response, and only then is it delivered. In the editor it appears visually distinct and is applied only if accepted, fully or partly; next edit suggestions predict where and what to change. Code references are checked when an unaltered suggestion is accepted.
- Copilot generates code probabilistically from its training data and the available context, so it can produce code that looks valid but is wrong or insecure, biased output, matches with public code or invented answers (hallucinations). Quality drops for under-represented languages and for prompts not written in English. Always review, test and scan what you accept.
4. Apply prompt engineering and context crafting
10–15%Craft effective prompts
- A good prompt starts with the overall goal and then lists the specific requirements. In Copilot Chat in the IDE it is combined with keywords: participants with @ (such as @terminal), slash commands with / (such as /tests) and chat variables with # (such as #selection) to supply context. With inline suggestions, the prompt is a comment that describes the expected code.
- For inline suggestions, Copilot combines the code before and after the cursor (Fill-in-the-Middle) with snippets from open tabs. In VS Code chat, the prompt gathers system instructions, customizations, the message, that chat's history, implicit context (selection, active file), # references and tool outputs; the agent finds more context with semantic, text or grep search.
- In zero-shot prompting Copilot generates code with no examples and relies only on its training, which works well for common patterns. One-shot gives one example so it follows your conventions, and few-shot gives several, which helps with custom formats, multiple scenarios and edge cases. Input data, expected outputs, implementations and unit tests all work as examples.
- Break complex tasks into small steps, avoid ambiguous terms such as "this" and name the function or response you mean. State the library you want, follow good coding practices (descriptive names, consistent style), include tests or acceptance criteria to verify the result, and refine with follow-up messages instead of starting from scratch.
Engineer prompts for performance
- Prompt engineering is crafting clear instructions so Copilot generates code that fits the project. It is summed up in the 4 Ss: Single (one well-defined task), Specific (explicit, detailed instructions), Short (concise without losing clarity) and Surround (descriptive file names and related files open). Role prompting asks Copilot to act as a specific kind of expert.
- The prompt travels over HTTPS with the gathered context, passes a proxy that blocks manipulation attempts and toxicity filters, and the LLM generates the response; quality, security and, if enabled, public code checks follow, and anything that fails is truncated or discarded. Chat uses the conversation history as context: start a new thread for another task, delete what is irrelevant and compact long conversations.
5. Improve developer productivity with GitHub Copilot
10–15%Enhance productivity and code quality
- Inline suggestions complete code, repetitive code and code from comments as you type; Copilot Chat generates large blocks you then refine, refactors code (names, conditionals, long methods, design patterns) and documents it with commands such as /doc. For linked multi-file documentation agent mode fits best; to predict the next edit after a change, use next edit suggestions.
- Copilot helps you understand unfamiliar code without breaking flow: on GitHub.com it explains repositories, files and commits; Copilot CLI acts as an always-available expert when told to ground answers in code, cite files and not guess; Copilot Spaces gather code and docs for recurring questions, and terminal inline chat suggests shell commands. Always verify the answers.
- Copilot generates mock data from a schema or a few sample records when you state the row count and patterns; with @mssql it needs a database connection to know the schema. To modernize legacy code, first write tests of current behavior, explain files and data flow, convert in small pieces, work in branches and always review the suggestions.
Support testing and security
- Copilot generates unit tests with /tests or with prompts that set scope and scenarios, and integration tests that use mocks to simulate external dependencies and verify calls. Reuse the project's framework, give existing tests as context (open tabs or #file), plan multi-file work with Plan and extend cases with ghost text.
- To make Copilot cover more than the happy path, explicitly ask for edge cases, exceptions and data validation, and test at and just outside each limit. Expected values come from requirements, not from the implementation or the function under test. When a test fails, find the cause and never weaken or skip assertions just to make them pass.
- Copilot Chat can spot common vulnerabilities (XSS, SQL injection) and propose fixes, and suggest optimizations such as better data structures, short transactions or a consistent access order. Copilot Autofix proposes fixes for code scanning alerts. Copilot is an extra layer: it does not replace code scanning or reviews, and its suggestions must always be reviewed and tested.
6. Configure privacy, content exclusions, and safeguards
10–15%Manage privacy settings and exclusions
- Content exclusion stops Copilot from using specific files: no inline suggestions in them and no influence on responses or code review. Repository admins, organization owners (for their own seats) and enterprise owners (for everyone) configure it with fnmatch paths, and changes appear in the audit log. In VS Code, github.copilot.enable turns Copilot on or off per language.
- GitHub does not claim ownership of Copilot inputs or outputs, and whether a suggestion can be owned depends on the applicable law. Output is provided as-is: it may be wrong, insecure or resemble public code, so the user must review and test it and check whether a third-party license is needed, just as with any code of unknown origin.
Apply safeguards and troubleshoot
- The suggestions matching public code policy can be set to Allow or Block. With Block, Copilot compares each suggestion and its context with public code on GitHub and hides matches; with Allow, it shows references with the URL and license. Pro users set it in their settings; with an organization seat it is inherited and, on conflict, the most restrictive setting wins.
- If suggestions are missing in some files, a crossed-out status bar icon points to content exclusion. Changes take time to reach the IDE: in VS Code, reload the window. Organization rules only affect users who get their seat from that organization, do not cover symlinks or remote filesystems, and changes are audited as copilot.content_exclusion_changed.